v2.0.0

Email Marketer

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:35 AM.

Analysis

This skill appears to be a local email-marketing logging helper, with the main thing to notice being that it stores entered campaign information persistently on your computer.

GuidanceBefore installing, confirm you are comfortable with a local shell CLI that records campaign-related inputs under ~/.local/share/email-marketer. Treat any customer segments, campaign costs, or performance metrics you enter as retained local data, and verify the script source/install path because the registry does not provide a homepage or install spec.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceMediumStatusNote

metadata

Source: unknown; Homepage: none ... No install spec — this is an instruction-only skill. ... Code file presence: scripts/script.sh

The skill includes a shell script and documents CLI usage, but the registry does not provide a clear source homepage or install specification.

User impactThere is no artifact-backed sign of malicious installation behavior, but users have less provenance information for verifying the CLI script and how it is installed.

RecommendationInstall only from a trusted registry/source, review the included script before use, and confirm the installed command points to the expected local script.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

SKILL.md

All data is stored locally at `~/.local/share/email-marketer/`. Each action is logged to its own file ... A unified `history.log` tracks all operations. The built-in export function supports JSON, CSV, and plain text formats.

The skill intentionally creates persistent local records of user-entered marketing information and can export them, so users should be aware of retention and sensitivity.

User impactCampaign plans, segments, performance metrics, costs, and other entered data may remain on the device and be visible through recent, search, or export commands.

RecommendationAvoid entering confidential customer or campaign data unless local retention is acceptable, and periodically delete or protect the data directory if needed.